Skip to content
CI

Corrige ordenação de imports acusada pelo lint #80

Sign in to view logs

Corrige ordenação de imports acusada pelo lint

Corrige ordenação de imports acusada pelo lint #80

Workflow file for this run

.github/workflows/ci.yml at 00e9e04
name: CI
on:
push:
branches: [ main, develop ]
tags: [ 'v*' ]
pull_request:
branches: [ main, develop ]
jobs:
test:
name: Test Python ${{ matrix.python-version }} on ${{ matrix.os }}
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
python-version: ['3.10', '3.11', '3.12']
steps:
- name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: ${{ matrix.python-version }}
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]"
# Nao tolerar exit code 5 ("no tests collected"). Uma suite que nao coleta
# nada — por erro de import numa dependencia, por exemplo — passaria como
# verde e esconderia a quebra. Ja aconteceu no synesis-lsp (jsonschema
# desatualizado abortava a coleta inteira). Se algum dia houver um alvo
# legitimamente sem testes, trate o caso nele, nao globalmente aqui.
- name: Run tests
run: |
pytest --cov=synesis --cov-report=xml --cov-report=term
- name: Upload coverage to Codecov
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.10'
with:
files: ./coverage.xml
flags: unittests
name: codecov-umbrella
token: ${{ secrets.CODECOV_TOKEN }}
fail_ci_if_error: false
lint:
name: Lint and Type Check
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: '3.10'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]"
- name: Run Ruff (linter)
run: |
ruff check synesis/
# MyPy is non-blocking against a measured legacy baseline (257 errors as of
# 2026-08-04; was 229 on 2026-07-13). Ruff above stays blocking. This mirrors the
# Golden Standard guidance for pre-existing debt: block on new code, track
# the backlog with a visible number instead of silently masking it, and
# burn it down in future cycles rather than in an unrelated PR.
- name: Run MyPy (type checker) — informational, non-blocking on legacy debt
continue-on-error: true
run: |
mypy synesis/ --ignore-missing-imports | tee mypy-report.txt
echo "MyPy error count (legacy baseline): $(grep -c ': error:' mypy-report.txt || echo 0)"
security:
name: Security (dependencies and secrets)
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
- name: Set up Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
# 3.11+ e obrigatorio AQUI: o passo abaixo le o pyproject.toml com
# `tomllib`, que so entrou na stdlib no 3.11. Com 3.10 o script morria
# em ModuleNotFoundError ANTES de auditar — o job falhava vermelho sem
# nunca ter executado o pip-audit, simulando vulnerabilidade onde nao
# havia. Isto e a versao do RUNNER, nao o piso suportado pelo pacote:
# `requires-python = ">=3.10"` continua valendo e a matriz de testes
# segue cobrindo 3.10.
python-version: '3.11'
- name: Audit dependencies (pip-audit)
run: |
python -m pip install --upgrade pip pip-audit
# Audita SOMENTE as dependencias de runtime que o pacote distribui.
# Nao instalamos o proprio synesis nem os extras [dev]: assim a auditoria
# e deterministica e nao falha por CVE em ferramenta de build (twine,
# etc.) ou por pacote-irmao presente num dev install. Sem --strict: deps
# ausentes do PyPI sao puladas, nao tratadas como erro.
python -c "import tomllib,pathlib; pathlib.Path('runtime-requirements.txt').write_text(chr(10).join(tomllib.load(open('pyproject.toml','rb'))['project']['dependencies']))"
cat runtime-requirements.txt
pip-audit -r runtime-requirements.txt --desc
- name: Scan for secrets (Gitleaks)
# Runs the gitleaks CLI directly instead of gitleaks/gitleaks-action:
# the action requires a license for organization repos on some plans and
# is being migrated off the deprecated Node 20 runtime. The CLI has no
# such requirement and is pinned by release tag below.
run: |
curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz gitleaks
./gitleaks git --redact -v
build:
name: Build Distribution
runs-on: ubuntu-latest
needs: [test, lint]
steps:
- name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: '3.10'
- name: Install build tools
run: |
python -m pip install --upgrade pip
pip install build twine
- name: Build package
run: |
python -m build
- name: Check distribution
run: |
twine check dist/*
- name: Upload artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: dist
path: dist/
integration:
name: Integration Tests
runs-on: ubuntu-latest
needs: test
steps:
- name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: '3.10'
- name: Install synesis
run: |
python -m pip install --upgrade pip
pip install -e .
- name: Test CLI commands
run: |
synesis --help
synesis --version
- name: Test compilation (smoke)
run: |
synesis compile tests/fixtures/Basic/project.synp --json output.json
test -f output.json
echo "✓ JSON export successful"
shell: bash
publish:
name: Publish to PyPI
runs-on: ubuntu-latest
needs: [test, lint, build]
if: startsWith(github.ref, 'refs/tags/v')
environment: pypi
permissions:
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: '3.10'
- name: Install build tools
run: |
python -m pip install --upgrade pip
pip install build
- name: Build package
run: python -m build
- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1